Error messages that talk too much
The Dolcemela pastry shop intranet is very polite: when you get the login wrong, it even tells you what you got wrong. Too polite? Find out who really has an account, then find your way into the restricted area.
Lab 6 of 7 in the Web Exploitation path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 50 and 120 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- Find the employees' names on the site (75 XP)
- Find out which name has an account (150 XP)
- Get a password wrong: the portal does not lock you out (75 XP)
- Get into the restricted area (150 XP)
Topics: web, user-enumeration, owasp-a07.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
curl: makes HTTP requests from the terminal and shows the server’s raw answer, headers included.cat: prints the contents of a file: the most direct way to read configurations, notes and logs.
The simulated environment
The target is an invented host on a simulated private network: you can only reach it from the game terminal.
The target exposes these services:
- SSH: encrypted remote command-line access; it is protected with keys instead of passwords and without direct root login.
- Web (HTTP): a web server with pages, APIs or admin panels: the most exposed part of almost every organisation.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
The portal said "wrong password" for accounts that exist and "unknown user" for the others: two different answers turn the login page into a list of valid accounts (user enumeration, OWASP A07). With no limit on attempts, a short list of common passwords did the rest. Defensive lesson: the same generic message ("invalid credentials") and the same response time in every case, a limit on attempts with a temporary lockout, strong passwords with two-factor verification and alerts on unusual attempts.
Before and after this lab
To unlock it you must have solved:
- The manufacturer's manual (Web Exploitation, medium)
After this lab you can move on to:
- The complete portal (Web Exploitation, hard)
The Web Exploitation path
Web Exploitation brings the basics into the world of websites and web applications, where a huge share of real attacks happen. You explore invented sites with HTTP requests from the terminal and discover folders someone hoped to hide, cookies the server trusts too much, factory credentials never changed, comments forgotten in the page source and error messages that say too much. The lessons follow the OWASP Top 10 categories, such as Broken Access Control and authentication failures, and each one explains the fix.